commit a294865978b701e4d0d90135672749531b9a900d
author Dan Rosenberg <drosenberg@vsecurity.com> Fri May 06 03:27:18 2011 +0000
committer David S. Miller <davem@davemloft.net> Fri May 06 13:05:50 2011 -0700
tree 4edb7c20db20d81867562fc5cbc0d7c7b5a70df5
parent 87e9af6cc67d842cd92b52b81f3f14e665e7ab05

dccp: handle invalid feature options length

A length of zero (after subtracting two for the type and len fields) for
the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to
the subtraction.  The subsequent code may read past the end of the
options value buffer when parsing.  I'm unsure of what the consequences
of this might be, but it's probably not good.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>